[Phase 2 / Feature B / B-1] Define NaCl protocol verbs for passkey authenticator + contract tests

[gynet]

Parent: #9. Umbrella design: docs/phase2-passkey-design.md. Type contract: docs/phase2-interfaces.md §1.

Scope

Extend the core↔extension NaCl protocol with four new action verbs:

• passkey-create-entry
• passkey-get-by-rp
• passkey-sign
• passkey-update-counter (optional — see design §1)

Add TypeScript types to both sides (mirrored):

• packages/extension/src/background/protocol/types.ts
• packages/core/app/scripts/comp/extension/protocol-impl.ts

Types are exactly as in docs/phase2-interfaces.md §1. Do not drift.

New error codes

PASSKEY_RP_MISMATCH, PASSKEY_VAULT_LOCKED, PASSKEY_NO_MATCH, PASSKEY_USER_CANCELLED, PASSKEY_COUNTER_REGRESSION, PASSKEY_UNSUPPORTED_ALG, PASSKEY_WRITE_FAILED.

Owner

SWE-Core + SWE-Ext jointly. Whichever lands first must stub the other side so CI stays green.

Acceptance

• Types exported from both sides match the doc byte-for-byte
• Contract test e2e/extension/passkey-protocol-contract.spec.ts exercises each verb end-to-end through the existing NaCl transport with fixture payloads
• No @ts-ignore / no-explicit-any introduced
• bun test passes for both packages
• No verb is added that is not in the design doc

Blocks

B-2, B-3, B-4 (all downstream work).